Log Parsing Analysis

(imported topic written by SystemAdmin)

There is a particular log in my environment that I need to parse to get some data. The trick is that each log may have multiple results and the information that I’m after is consistently two lines above the criteria that I’m parsing for. This file format looks something like this:

junk

junk

abc unique bit of data xyz

junk

criteria

junk

junk

junk

junk

abc unique bit of data xyz

junk

criteria

So on my Win7 machine, I compose the following in QNA which works perfectly:

Q: ((substring before " xyz" of substring after "abc " of it) of previous lines of previous lines of lines containing “criteria” of it) of file “c:\temp\abc.log”

A: unique bit of data

A: unique bit of data

Putting this into an analysis and applying it to XP and 2003 machines yields an error status in the analysis. Running the same thing in QNA on an XP or 2003 machine results in Singular Expression refers to nonexistent object.

What am I missing? Is there a better way to do this?

(imported comment written by jessewk)

Looks like either the file doesn’t exist or ‘xyz’ doesn’t exist or ‘abc’ doesn’t exist.

You can guard against that by using plurals. Try this:

Q: ((substrings before " xyz" of substrings after "abc " of it) of previous lines of previous lines of lines containing “criteria” of it) of files “c:\temp\abc.log”

Jesse

(imported comment written by SystemAdmin)

The file does exist. ‘abc’ and ‘xyz’ also exist. That isn’t the problem point. In fact, even if I remove the ‘substrings’ qualification part in the beginning, the issue persists. It is the getting the ‘unique data’ that is two lines previous that is the issue.

On Win7 this part evaluates fine, but XP or 2003 clients show “Singular Expression refers to nonexistent object”: (previous lines of previous lines of lines containing “criteria” of it) of files “c:\temp\abc.log”

(imported comment written by jessewk)

Are you sure you evaluated this exact expression on Windows XP/2003:

(previous lines of previous lines of lines containing “criteria” of it) of files “c:\temp\abc.log”

Because the expression doesn’t contain any singular expressions so it will never throw a singular expression error.